You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by kh...@apache.org on 2010/09/20 08:58:21 UTC
svn commit: r998806 -
/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Author: khopesh
Date: Mon Sep 20 06:58:20 2010
New Revision: 998806
URL: http://svn.apache.org/viewvc?rev=998806&view=rev
Log:
auto-generated rules
Modified:
spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
Modified: spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf
URL: http://svn.apache.org/viewvc/spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf?rev=998806&r1=998805&r2=998806&view=diff
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf (original)
+++ spamassassin/trunk/rulesrc/sandbox/khopesh/20_khop_sc_bug_6114.cf Mon Sep 20 06:58:20 2010
@@ -1,4 +1,4 @@
-## khop-sc-neighbors.cf v 201009192
+## khop-sc-neighbors.cf v 201009202
## Khopesh's syndication of SpamCop's top offenders and top offending networks.
##
## Spamassassin rules written by Adam Katz <antispamATkhopiscom>
@@ -21,7 +21,7 @@
# http://spamcop.net/w3m?action=map;mask=4294967295;net=0;sort=56
# Due to the massive block size, this rule only examines the last untrusted
-header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:22|89)|9[24])(?:\.[012]?\d{1,2}){3}\b) /
+header __KHOP_SC_CIDR8 X-Spam-Relays-Untrusted =~ /^[^\]]* (?:by|ip)=(?-xism:\b(?:1(?:22|78|89)|94)(?:\.[012]?\d{1,2}){3}\b) /
# and gets cleaned up a bit
meta KHOP_SC_CIDR8 __KHOP_SC_CIDR8 && !(__VIA_ML||__freemail_safe||__RCVD_IN_DNSWL||RCVD_IN_HOSTKARMA_WL)
describe KHOP_SC_CIDR8 Relay CIDR /8 is among worst in SpamCop
@@ -72,7 +72,7 @@ score KHOP_SC_CIDR16 1.6 0.5 1.6 0.5
# 0 /0 0 20100409 (wha!?)
# crap, still empty 20100410 bad scrape, script failed to populate rule
-header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:23\.2[67]|15\.240)|94\.159)(?:\.[012]?\d{1,2}){2}\b)/
+header KHOP_SC_TOP_CIDR16 Received =~ /(?-xism:\b(?:1(?:23\.2[67]|15\.240)|78\.96)(?:\.[012]?\d{1,2}){2}\b)/
describe KHOP_SC_TOP_CIDR16 Relay CIDR /16 leads SpamCop in worst /16s
tflags KHOP_SC_TOP_CIDR16 nopublish
score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0.5
@@ -89,7 +89,7 @@ score KHOP_SC_TOP_CIDR16 2.0 0.5 2.0 0
# http://spamcop.net/w3m?action=map;net=cmaxcnt;mask=65535;sort=spamcnt
-header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:9\.(?:(?:239\.4|62\.)7|55\.0)|3\.(?:144\.136|217\.145)|1\.191\.198)|1(?:7\.(?:118\.8[123]|66\.146)|3\.(?:233|87)\.64))|1(?:09\.205\.2(?:48|52)|13\.162\.60|21\.78\.236)|9(?:5\.1(?:29\.16|54\.11)|3\.186\.9)6|7(?:8\.138\.17[01]|7\.74\.36)|8(?:7\.252\.227|3\.149\.21)|66\.118\.177|41\.254\.1)\.[012]?\d{1,2}\b)/
+header KHOP_SC_CIDR24 Received =~ /(?-xism:\b(?:2(?:0(?:3\.(?:144\.136|217\.145)|1\.191\.198|2\.129\.235|9\.55\.0)|1(?:7\.(?:118\.8[123]|66\.146)|3\.(?:233|87)\.64))|(?:95\.1(?:29\.16|54\.11)|121\.78\.23)6|7(?:8\.138\.17[01]|7\.74\.36)|6(?:4\.187\.118|6\.118\.177)|8(?:7\.252\.227|3\.149\.21)|41\.254\.1|0\.0\.0)\.[012]?\d{1,2}\b)/
describe KHOP_SC_CIDR24 Relay CIDR /24 is among worst in SpamCop
tflags KHOP_SC_CIDR24 nopublish
score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
@@ -106,7 +106,7 @@ score KHOP_SC_CIDR24 2.5 0.6 2.5 0.6
# 0.2960/0 1.000 20100409
# 0.2905/0 1.000 20100410 net
-header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:8\.2(?:25|36)|118\.90)|3\.(?:233\.64|87\.76)|8\.248\.64)|0(?:3\.(?:152\.2|82\.95)|2\.152\.243)|21\.143\.46)|8(?:5\.26\.(?:2(?:3[2345]|41)|1(?:6[45]|86))|3\.149\.(?:3[27]?|4[345]|21)|1\.192\.2(?:15|38)|9\.232\.105|2\.178\.69)|1(?:1(?:3\.162\.(?:6[47]|100|245|77|96)|1\.224\.250)|09\.166\.128|74\.137\.41|88\.135\.2)|7(?:7\.232\.14[23]|8\.138\.171|9\.106\.109)|6(?:4\.187\.118|9\.172\.199|1\.19\.66)|41\.(?:254\.[01]|95\.4)|91\.203\.67)\.[012]?\d{1,2}\b)/
+header KHOP_SC_TOP_CIDR24 Received =~ /(?-xism:\b(?:2(?:1(?:7\.(?:8\.2(?:25|36)|118\.90)|3\.(?:233\.64|87\.76)|8\.248\.64)|0(?:3\.(?:152\.2|82\.95)|2\.152\.243|9\.62\.7)|21\.143\.46)|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[27]?|4[345]|21)|1\.192\.2(?:15|38)|9\.232\.105|2\.178\.69)|1(?:1(?:3\.162\.(?:6[47]|100|245|77|96)|1\.224\.250)|09\.166\.128|74\.137\.41|88\.135\.2)|7(?:7\.232\.14[23]|8\.138\.171|9\.106\.109)|9(?:1\.203\.67|3\.186\.96|2\.39\.71)|6(?:9\.172\.199|1\.19\.66)|41\.(?:254\.[01]|95\.4)|59\.99\.128)\.[012]?\d{1,2}\b)/
describe KHOP_SC_TOP_CIDR24 Relay CIDR /24 leads SpamCop in worst /24s
tflags KHOP_SC_TOP_CIDR24 nopublish
score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0.6
@@ -123,7 +123,7 @@ score KHOP_SC_TOP_CIDR24 2.7 0.6 2.7 0
# http://www.spamcop.net/w3m?action=hoshame
-header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:2(?:1(?:2\.(?:11(?:1\.(?:199\.17|203\.18)0|8\.142\.7[67])|4(?:2\.117\.62|5\.2\.110)|50\.20\.190|85\.103\.45)|3\.1(?:(?:98\.113\.14|38\.94\.13)4|8(?:8\.130\.113|4\.224\.44))|7\.(?:1(?:16\.47\.8|73\.21\.5|6\.4\.31)|76\.2\.129|26\.6\.96)|8\.(?:1(?:58\.156\.103|45\.71\.242)|248\.44\.196)|1\.(?:2(?:24\.129\.18|02\.2\.6)0|13\.204\.1)|6\.157\.146\.2)|0(?:0\.(?:2(?:34\.200\.240|19\.245\.41)|1(?:07\.125\.82|41\.87\.135)|80\.140\.61)|9\.(?:62\.7\.(?:7[26]|87)|239\.47\.205|55\.0\.170)|1\.(?:1(?:16\.140\.246|44\.130\.21)|251\.250\.3)|3\.(?:14(?:6\.252\.241|4\.136\.7)|217\.145\.107)|2\.(?:145\.138\.5|29\.52\.12)|4\.10\.1(?:39\.194|41\.183)|8\.131\.186\.2)|2(?:2\.(?:12(?:4\.178\.158|2\.157\.90)|2(?:36\.47\.95|52\.223\.2))|(?:0\.231\.69\.1|1\.143\.46\.3)3))|1(?:9(?:5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|82\.194\.195)|2(?:30\.(?:180\.15|99\.2)0|22\.127\.19)|5\.124\.250)|4\.(?:1(?:26\.180\.1(?:19|0)|35\.105\.232|58\.206\.90|70\.16\.
85)|50\.(?:125\.38|9\.114)|44\.21\.4[89]|79\.63\.86)|3\.(?:1(?:7(?:8\.147\.164|\.253\.13)|07\.184\.193)|23(?:9\.44\.190|1\.238\.4)|40\.160\.32)|0\.(?:26\.249\.9|4\.15\.5)8)|2(?:1\.(?:78\.236\.47|1\.18\.242|50\.16\.11)|2\.252\.2(?:46\.23|34\.7)4|4\.232\.147\.10)|7(?:8\.(?:21(?:0\.32\.194|7\.208\.2)|32\.64\.195)|4\.137\.41\.2(?:3[39]|28|49))|1(?:5\.(?:117\.35\.158|248\.56\.145)|1\.224\.250\.13[234]|6\.0\.7\.2)|8(?:8\.(?:95\.51\.1(?:35|48)|226\.115\.16)|3\.81\.169\.3)|09\.(?:166\.128\.[01234567]|87\.92\.107))|8(?:9\.(?:1(?:61\.1(?:41\.147|99\.235|58\.80)|89\.169\.1[34]|56\.75\.171)|20(?:0\.152\.10|8\.157\.59))|0\.(?:2(?:35\.105\.14|55\.16\.13)0|9(?:5\.70\.173|7\.51\.66)|65\.16\.71)|7\.2(?:52\.227\.(?:4[04]?|8[48]|[37]2|56)|26\.242\.7)|2\.(?:1(?:93\.140\.16[48]|40\.91\.41)|76\.132\.177)|3\.(?:1(?:42\.111\.228|6\.195\.134)|65\.97\.194)|1\.(?:20\.104\.173|88\.212\.2)|4\.15\.191\.254|5\.17\.3\.215|6\.98\.9\.137)|9(?:1\.(?:1(?:9(?:(?:5\.(?:136|230)\.1|0\.232\.23)4|3\.(?:34\.147|199\
.4)|8\.175\.252)|21\.118\.218|49\.173\.2)|20(?:3\.62\.131|7\.210\.46))|4\.(?:2(?:3(?:\.219\.101|2\.59\.33)|45\.156\.33)|1(?:53\.248\.78|88\.32\.73|02\.5\.20)|79\.36\.210)|3\.(?:1(?:(?:13\.162\.19|25\.40\.1)5|59\.240\.59)|9(?:5\.168\.122|1\.196\.99))|2\.243\.17\.222)|6(?:6\.(?:11(?:8\.177\.19[378]|\.122\.27)|235\.160\.43)|9\.1(?:72\.199\.1(?:6[78]|72)|42\.92\.194)|4\.1(?:87\.118\.(?:65|71)|5\.147\.204)|1\.1(?:39\.151\.18|9\.252\.89)|2\.141\.122\.146|5\.254\.56\.162|7\.220\.196\.18)|7(?:8\.(?:111\.47\.(?:10|6)|40\.254\.1)|(?:6\.161\.241\.11|2\.54\.21\.4)5|7\.2(?:24\.185\.117|39\.236\.193)|0\.108\.253\.223)|41\.137\.(?:(?:24|30|56)\.4|63\.20[123])|38\.112\.60\.242|59\.18\.64\.3)\b)/
+header KHOP_SC_TOP200 Received =~ /(?-xism:\b(?:2(?:1(?:2\.(?:11(?:1\.(?:199\.17|203\.18)0|8\.142\.7[67])|57\.143\.163|85\.103\.45|45\.2\.110)|3\.1(?:(?:98\.113\.14|38\.94\.13)4|8(?:8\.130\.113|4\.224\.44))|7\.(?:1(?:16\.47\.8|73\.21\.5|6\.4\.31)|76\.2\.129|26\.6\.96)|8\.(?:1(?:58\.156\.103|45\.71\.242)|248\.44\.196)|1\.(?:2(?:24\.129\.18|02\.2\.6)0|13\.204\.1)|0\.122\.170\.6|6\.157\.146\.2)|0(?:0\.(?:2(?:34\.200\.240|19\.245\.41)|1(?:07\.125\.82|41\.87\.135)|80\.140\.61)|9\.(?:62\.7\.(?:7[26]|87)|239\.47\.205|55\.0\.170)|1\.(?:1(?:16\.140\.246|44\.130\.21)|251\.250\.3)|3\.(?:14(?:6\.252\.241|4\.136\.7)|217\.145\.107)|2\.(?:145\.138\.5|29\.52\.12)|4\.10\.1(?:39\.194|41\.183)|8\.131\.186\.2)|2(?:2\.(?:12(?:4\.178\.158|2\.157\.90)|2(?:36\.47\.95|52\.223\.2))|(?:0\.231\.69\.1|1\.143\.46\.3)3))|1(?:9(?:4\.(?:1(?:26\.180\.1(?:19|0)|35\.105\.232|58\.206\.90|70\.16\.85)|50\.(?:1(?:16\.29|25\.38)|9\.114)|44\.21\.4[89]|79\.63\.86)|5\.(?:1(?:6(?:1\.(?:40\.10|8\.1|9\.2)|0\.253\.4)|82
\.194\.(?:195|223))|2(?:30\.(?:180\.15|99\.2)0|22\.127\.19)|5\.124\.250)|3\.(?:1(?:7(?:8\.147\.164|\.253\.13)|07\.184\.193)|23(?:9\.44\.190|1\.238\.4)|40\.160\.32)|0\.(?:26\.249\.9|4\.15\.5)8)|1(?:5\.(?:248\.56\.1(?:37|45)|117\.35\.158)|1\.224\.250\.13[234]|8\.165\.204\.209|6\.0\.7\.2)|2(?:1\.(?:78\.236\.47|1\.18\.242|50\.16\.11)|2\.252\.2(?:46\.23|34\.7)4|4\.158\.93\.71)|7(?:8\.(?:21(?:0\.32\.194|7\.208\.2)|32\.64\.195)|4\.137\.41\.2(?:3[39]|28|49))|8(?:8\.(?:95\.51\.1(?:35|48)|226\.115\.16)|3\.81\.169\.3)|09\.(?:166\.128\.[01234567]|95\.192\.131))|8(?:9\.(?:1(?:61\.1(?:41\.147|99\.235|58\.80)|89\.169\.1[34]|56\.75\.171)|2(?:0(?:0\.152\.10|8\.157\.59)|51\.107\.35)|74\.3\.215)|2\.(?:1(?:93\.140\.16[48]|14\.76\.210|40\.91\.41)|76\.132\.177)|0\.(?:9(?:5\.70\.173|7\.51\.66)|235\.105\.140|65\.16\.71)|7\.2(?:52\.227\.(?:8[48]|[37]2|4?4|56)|26\.242\.7)|3\.(?:1(?:42\.111\.228|6\.195\.134)|65\.97\.194)|5\.(?:17\.3\.215|43\.241\.1)|4\.15\.191\.254|1\.88\.212\.2|6\.98\.9\.137)|9(?:1\.
(?:1(?:9(?:5\.(?:230\.1[14]|136\.14)|8\.175\.252|3\.199\.4)|21\.118\.218|49\.173\.2)|20(?:3\.62\.131|7\.210\.46))|3\.(?:1(?:(?:13\.162\.19|25\.40\.1)5|59\.240\.59)|9(?:5\.168\.122|1\.196\.99))|4\.(?:2(?:3\.219\.101|45\.156\.33)|1(?:88\.32\.73|02\.5\.20))|2\.243\.17\.222|5\.62\.150\.86)|6(?:6\.(?:11(?:8\.177\.19[378]|\.122\.27)|235\.160\.43)|9\.1(?:72\.199\.1(?:6[78]|72)|42\.92\.194)|4\.1(?:5\.147\.204|87\.118\.71)|1\.1(?:39\.151\.18|9\.252\.89)|2\.141\.122\.146|5\.254\.56\.162|7\.220\.196\.18)|7(?:(?:6\.161\.241\.11|2\.54\.21\.4)5|7\.2(?:24\.185\.117|39\.236\.193)|8\.111\.47\.(?:10|6)|0\.108\.253\.223)|41\.137\.(?:(?:24|30|56)\.4|63\.20[123])|38\.112\.60\.242|59\.18\.64\.3)\b)/
describe KHOP_SC_TOP200 Relay listed in SpamCop top 200 spammer IPs
tflags KHOP_SC_TOP200 nopublish
score KHOP_SC_TOP200 4 0 4 0 # unnecessary if DNSBLs work
@@ -140,7 +140,7 @@ score KHOP_SC_TOP200 4 0 4 0 # unneces
# PSBL-neighbors: any /24 with 73+ (2/7, 29%) IPs in the PSBL (not SpamCop),
# as obtained from rsync://psbl-mirror.surriel.com::psbl/psbl.txt
-header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:7\.(?:2(?:0(?:0\.(?:1(?:9[2345678]|7[06789]|8[01234]|4[456]|6\d)|2(?:1[0123456]|0[89]|25)|3[24]|51|99)|5\.(?:1(?:[67]|4[45]|00)?|34|98)|4\.1(?:6[01267]|4[45])|1\.4[89])|4(?:1\.(?:2(?:5[234]|1[67]|4[04]|00|24|32)|1(?:7[67]?|2?8|3?6|12|44|9)|8[0128]?|6[45]|48)|2\.(?:1(?:4[014]|96)?|(?:24?)?8|4[04]|6?0)))|19(?:9\.(?:1(?:1[369]|4[456]|8[01]|79|93)|5[0123456]|3[23]|4[89])|8\.(?:[024]|1(?:6[05])?|9[01234]|32?|8\d)|6\.(?:2(?:2[4568]|12|31)|34)|7\.(?:6[4568]|96)|5\.(?:6[678]|72)|4\.9[67]))|3\.(?:1(?:6(?:2\.(?:2(?:2[45789]|4[03456]|1[67]|3[49])|1(?:2[034678]|3[2389]|0[01])|7[014679]|9[0678]|6[457]|8[037]|56)|8\.1(?:4[0123]|2[89])|9\.1(?:8[0123]|53)|7\.(?:11)?1)|85\.1)|22\.6?8)|8\.(?:68\.(?:1(?:2[01]|9[26])|2(?:4[89]|53))|71\.[89])|5\.147\.(?:2(?:0[123]|3[012]|29)|192)|0\.49\.193|4\.79\.150)|2(?:2\.16(?:8\.(?:2(?:0[2489]?|1[089]|2[59]|3[14]|47)|1(?:[279]|61)|6[89])|3\.184)|0\.6(?:0\.[17]|2\.163)|3\.(?:18\.242|23
\.255))|8(?:3\.8(?:0\.1(?:3[125]|29|77)|7\.198)|0\.194\.1|8\.135\.2)|9(?:0\.110\.155|4\.230\.146)|78\.123\.(?:4[02]|24))|5(?:9\.(?:9(?:9\.(?:1(?:5[2345]|2[89]|30|92)|5[6789]|[37]2|208|40)|5\.(?:6[4578]|7[013]?|1[368]|2[38])|7\.(?:2(?:1[0678]|0[89])|192)|8\.1(?:6[01]|9[23]|44|52)|4\.113)|164\.2)|8\.18(?:6\.(?:2(?:1[6789]|20)|1(?:9[67]|4))|7\.8))|2(?:1(?:3\.(?:1(?:08\.172|32\.255)|87\.(?:194|76|88))|7\.(?:8\.2(?:25|36)|118\.90|66\.146)|2\.23\.10[45]|8\.248\.64)|0(?:3\.(?:1(?:28\.250|52\.2)|82\.95)|2\.152\.243)|22\.25(?:3\.(?:2[457]|177)|2\.244|4\.78))|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[27]?|4[345]|2[18])|9\.2(?:04\.1(?:37|53)|32\.105)|1\.192\.2(?:15|38)|2\.178\.69)|9(?:2\.39\.(?:7[019]|65)|5\.129\.166|1\.203\.67)|41\.(?:2(?:54\.[012]|02\.199)|95\.[248])|7(?:7\.232\.14[23]|8\.138\.17[01])|61\.19\.6[567])\.[012]?\d{1,2}\b)/
+header KHOP_PSBL_CIDR24 X-Spam-Relays-Untrusted =~ /(?-xism:\b(?:1(?:1(?:7\.(?:2(?:0(?:0\.(?:1(?:9[2345678]|7[06789]|8[01234]|4[456]|6\d)|2(?:1[0123456]|0[89]|2[45])|34|97)|4\.1(?:6[01267]|4[45])|5\.1(?:00|44|6)?|1\.(?:4[89]|64))|4(?:1\.(?:2(?:5[234]|4[04]|00|17|24|32)|1(?:7[67]|2?8|3?6|12|44|9)?|8[0128]?|6[45]|48|0)|2\.(?:1(?:4[014]|12)?|(?:24?)?8|4[04]|6?0)))|19(?:9\.(?:1(?:4[56]|8[01]|79|93)|5[0123456]|4[89]|33)|8\.(?:[124]|9[01234]|3[234]?|5?0|8\d)|6\.(?:2(?:2[458]|3[14]|12)|34)|7\.(?:6[4567]|96|3)|5\.(?:6[67]|72)|4\.9[67])|6\.80)|3\.(?:1(?:6(?:2\.(?:2(?:2[45789]|4[03456]|3[489]|1[67])|1(?:2[034678]|3[2389]|0[01])|7[014679]|9[0678]|6[457]|8[037]|56)|9\.1(?:8[0123]|08|11|53)|8\.1(?:4[0123]|2[89])|7\.(?:11)?1)|85\.1)|22\.6?8)|8\.(?:68\.(?:1(?:2[01]|9[26])|2(?:4[89]|53))|71\.[89])|5\.147\.(?:2(?:0[123]|3[012]|29)|192)|4\.79\.1(?:42|50)|6\.109\.156|9\.159\.200|0\.49\.193)|2(?:2\.16(?:8\.(?:2(?:1[09]|3[14]|02?|29)|1[279]|69)|3\.184)|3\.(?:18\.242|28\.143)|0\.60\.[17])|8(?:3\
.8(?:0\.1(?:3[125]|29|77)|7\.198)|0\.194\.[01]|8\.135\.2)|9(?:0\.110\.155|4\.230\.146)|78\.123\.(?:3[25]|4[02]|24))|5(?:9\.(?:9(?:9\.(?:1(?:5[2345]|2[89]|30)|5[6789]|[37]2|40)|5\.(?:6[45678]|7[013]?|13|28)|7\.(?:2(?:1[0678]|0[89])|192)|8\.1(?:6[01]|9[23]|44|52)|4\.113)|164\.[28])|8\.18(?:6\.(?:2(?:1[6789]|20)|1(?:9[67]|4))|7\.8))|2(?:1(?:3\.(?:1(?:08\.172|32\.255)|87\.(?:194|76|88))|7\.(?:8\.2(?:25|36)|118\.90|66\.146)|2\.23\.10[45]|8\.248\.64)|0(?:3\.(?:1(?:28\.250|52\.2)|82\.95)|2\.152\.243)|22\.25(?:3\.(?:2[457]|177|30)|2\.244|4\.78))|8(?:5\.26\.(?:1(?:6[45]|8[36])|2(?:3[2345]|41))|3\.149\.(?:3[27]?|4[345]|2[18])|9\.2(?:04\.1(?:37|53)|32\.105)|1\.192\.2(?:15|38)|2\.178\.69)|41\.(?:2(?:54\.[0123]|02\.199)|95\.[248])|9(?:2\.39\.(?:7[019]|65)|1\.203\.67)|7(?:7\.232\.14[23]|8\.138\.17[01])|61\.19\.6[567])\.[012]?\d{1,2}\b)/
describe KHOP_PSBL_CIDR24 Relay's IP/24 CIDR contains many PSBL hits
tflags KHOP_PSBL_CIDR24 nopublish
score KHOP_PSBL_CIDR24 1.8 0.8 1.8 0.8